Asci, Terry (SCA) 


From: noreply@formstack.com 

Sent: Monday, April 02, 2018 12:49 PM 

To: Breaches, Data (SCA) 

Subject: Security Breach Notifications 





Formstack Submission For: 

Security Breach Notifications 


Submitted at 04/02/18 12:49 PM 


| Business Name: Jj ' g | 

Mintz Levin 


Business Address: 

:; AT Financial Center A 

Boston, MA 02111 


Foreign Business Address: 



Company Type: 

Commercial 


: Your Name:' . ; 

Cynthia Larose 


'■ . Title: . - , . * 

Member 


Contact Address: 


' ' ' ■ ■ , ;/■ ■■■■./■; 

Foreign Contact Address: 


: 

Telephone Number: 

(617)348^732 
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@Exte$sty^ 
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Email Address: . - 

cjLarose@mintz.com 
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Relationship to Org: 

Current employee 


Breach Type: 
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Date Breach was Discovered: 

03/09/2018 

Number of'Massachusetts Residents 
Affected: 

1 

Person responsible for data breach,: 

Current Employee 

Please give a detailed explanation of 
fiow the data h reach.occurred,: 

. An employee requested an electronic copy of her W-2, and 
in replying to this request, on March 9, an HR employee 
inadvertently sent the email and attachment to someone 
with a similar name outside the company. That same day, 
the unintended recipient called the HR employee to notify 
her of the error and to let her know that she did not open the 
attachment and had deleted the email and attachment from 
her inbox and purged the trash folder. On March 12, the 
unintended recipient provided us with an email 
confirmation that she had not made any copy, printed, 
saved, or otherwise retained the misdirected email and/or 
attachment. This was an unfortunate error and no breach of 
!§§ network systems occurred. SJ||M|||||||||i|g §| | 

! Please select the type of personal 
information that was included in the 
breached data.: 

Social Security Numbers = Selection(s) 

Please cheek ALL of the boxes that 
apply to your breach.: 

The person(s) with possession of personal information had 
authorized access = Selection(s) 

j For breaches involving paper: A 
lock or security mechanism was used 
to physically protect the data.: 

N/A 

Physical access to systems containing 
personal information was restricted 
to authorized personnel only.: 

If ■ 

Network configuration of breached 

I system: 

N/A 

. For breaches involving.'electronic .. 
systems, complete the following: 

N/A = Selection(s) 

AH Massachusetts residents affected 
by the breach have been notified of 
! the breach.: 

Yes 
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was re- 


Method{s) used to notify - 
Massacluisetts-residents,affected :hy 
the b reaeh -{cheekall ill at apply):: 

E-mail = Selection(s) 

US Mail - Selections) 

8SIISilSIIlliiBli!S!II 

Date notices were first sent to 
Massachusetts residents 
| • (MM/DD/YYYY): : • 

03/14/2018 


■ All Massachusetts residents affected 
: by the breach have been offered 
.'complimentary credit monitoring' 



No 


■ servicesy yyy; 



Law enforcement has been notified 
of this data breach.: 

No 


. Please describe how your company 




Copyright €> 2018 Formsiack, LLC. All rights reserved. This is a customer service email. 


Formstack, 8604 Allisonville Road. Suite 300. Indianapolis. IN 46250 
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Asci, Terry (SCA) 


From: 

Sent: 

To: 

Subject: 

Attachments: 


Larose, Cynthia <CJLarose@mintz.com> 
Monday, April 02, 2018 12:50 PM 
Breaches, Data (SCA) 

Notice pursuant to MGL 93H 
MLnotice.PDF 


Per the form filed online today. 


Cynthia Larose | Member 

Mintz, Levin, Cohn, Ferris, Glovskyand Popeo, P.C. 
One Financial Center | Boston, MA 02111 
Direct: +1.617.348.1732 | Fax: +1,617.542.2241 
E-mail: CJLarose@mintz.com 
Follow our blog ... Privacy & Security Matters 
Web: www.mintz.com 



STATEMENT OF CONFIDENTIALITY: 

The information contained in this electronic message and any attachments 
to this message are intended for the- exclusive use of the adclressee(s) 
and may contain confidential or privileged information. If you are not 
the intended recipient, or the person responsible for delivering the 
e-mail to the intended recipient, be advised you have received this 
message in error and that any use, dissemination, forwarding, printing, 
or copying is strictly prohibited. Please notify Mintz. Levin. Cohn. 

Ferris, Glovsky and Popeo immediately at either (617) 542-6000 or at 
DirectoroflT@Mintz.com, and destroy all copies of this message and any 
attachments. You will be reimbursed for reasonable costs incurred in 
notifying us. 
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MINTZ LEVIN 


One Financial Center 
Boston, MA 02111 
617-542-6000 
617-542-2241 fax 
www.mintz.com 


March 27, 2018 


Dear BHHi 

We are writing to notify you that an unauthorized acquisition of your personal information occurred on 
March 9, 2018. As we discussed, we have no reason to believe that your personal information has been or 
will be misused and this was an isolated incident as the result of an unfortunate error. There has been no 
security breach of our network system. 

Massachusetts law requires us to provide you with certain information regarding credit freezes and 
protection from identity theft. Massachusetts law allows consumers to place a security freeze on their 
credit reports. A security freeze prohibits a credit reporting agency from releasing any information from a 
consumer’s credit report without written authorization. However, please be aware that placing a security 
freeze on your credit report may delay, interfere with, or prevent the timely approval of any requests you 
make for new loans, credit mortgages, employment, housing or other services. 

If you have been a victim of identity theft, and you provide the credit reporting agency with a valid police 
report, it cannot charge you to place, lift or remove a security freeze. In all other cases, a credit reporting 
agency may charge you up to $5.00 each to place, temporarily lift, or permanently remove a security 
freeze. 

To place a security freeze on your credit report, you must send a written request to each of the three 
major consumer reporting agencies: Equifax (www.equifax.com); Experian (www.experian.com); and 
TransUnion (www.transunion.com) by regular, certified or overnight mail at the addresses below: 

Equifax Security Freeze 
P.O. Box 105788 
Atlanta, GA 30348 

Experian Security Freeze 
P.O. Box 9554 
Allen, TX 75013 

Trans Union Security Freeze 
Fraud Victim Assistance Department 
P.O. Box 2000 
Chester, PA 19022-2000 

Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C. 

Boston | Washington j NbwYork | Stamford | Los Angfi.es j San Francisco 1 San Diego | London 





Mintz, Levin, Cohn, Ferns, Glovsky and Popeo, P,C. 
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In order to request a security freeze, you will need to provide the following information: 

1. Your full name (including middle initial as well as Jr., Sr., II, III, etc.); 

2. Social Security Number; 

3. Date of birth; 

4. If you have moved in the past five (5) years, provide the addresses where you have lived over the prior 
five years; 

5. Proof of current address such as a current utility bill or telephone bill; 

6. A legible photocopy of a government issued identification card (state driver’s license or ID card, 
military identification, etc.) 

7. If you are a victim of identity theft, include a copy of either the police report, investigative report, or 
complaint to a law enforcement agency concerning identity theft; 

8. If you are not a victim of identity theft, include payment by check, money order, or credit card (Visa, 
MasterCard, American Express or Discover only). Do not send cash through the mail. 

The credit reporting agencies have three (3) business days after receiving your request to place a security 
freeze on your credit report. The credit bureaus must also send written confirmation to you within five (5) 
business days and provide- you with a unique personal identification number (PIN) or password, or both 
that can be used by you to authorize the removal or lifting of the security freeze. 

To lift the security freeze in order to allow a specific entity or individual access to your credit report, you 
must call or send a written request to the credit reporting agencies by mail and include proper 
identification (name, address, and social security number) and the PIN number or password provided to 
you when you placed the security freeze as well as the identities of those entities or individuals you would 
like to receive your credit report or the specific period of time you want the credit report available. The 
credit reporting agencies have three (3) business days after receiving your request to lift the security 
freeze for those identified entities or for the specified period of time. 

To remove the security freeze, you must send a written request to each of the three credit bureaus by mail 
and include proper identification (name, address, and social security number) and the PIN number or 
password provided to you when you placed the security freeze. The credit bureaus have three (3) business 
days after receiving your request to remove the security freeze. 

Under Massachusetts law, we are required to inform you that you have the right to obtain any police 
report filed in regard to this incident. Given the nature of this incident, there was no police report filed. 

If you should have any further questions, please contact do not hesitate to contact me at 617 MHHH. 

Sincerely, 


76634528v. 1 




